checkServerHelloOrHRR does validity checks that apply to both ServerHello and HelloRetryRequest messages. It sets hs.suite.
()
| 108 | // checkServerHelloOrHRR does validity checks that apply to both ServerHello and |
| 109 | // HelloRetryRequest messages. It sets hs.suite. |
| 110 | func (hs *clientHandshakeStateTLS13) checkServerHelloOrHRR() error { |
| 111 | c := hs.c |
| 112 | |
| 113 | if hs.serverHello.supportedVersion == 0 { |
| 114 | c.sendAlert(alertMissingExtension) |
| 115 | return errors.New("tls: server selected TLS 1.3 using the legacy version field") |
| 116 | } |
| 117 | |
| 118 | if hs.serverHello.supportedVersion != VersionTLS13 { |
| 119 | c.sendAlert(alertIllegalParameter) |
| 120 | return errors.New("tls: server selected an invalid version after a HelloRetryRequest") |
| 121 | } |
| 122 | |
| 123 | if hs.serverHello.vers != VersionTLS12 { |
| 124 | c.sendAlert(alertIllegalParameter) |
| 125 | return errors.New("tls: server sent an incorrect legacy version") |
| 126 | } |
| 127 | |
| 128 | if hs.serverHello.ocspStapling || |
| 129 | hs.serverHello.ticketSupported || |
| 130 | hs.serverHello.secureRenegotiationSupported || |
| 131 | len(hs.serverHello.secureRenegotiation) != 0 || |
| 132 | len(hs.serverHello.alpnProtocol) != 0 || |
| 133 | len(hs.serverHello.scts) != 0 { |
| 134 | c.sendAlert(alertUnsupportedExtension) |
| 135 | return errors.New("tls: server sent a ServerHello extension forbidden in TLS 1.3") |
| 136 | } |
| 137 | |
| 138 | if !bytes.Equal(hs.hello.sessionId, hs.serverHello.sessionId) { |
| 139 | c.sendAlert(alertIllegalParameter) |
| 140 | return errors.New("tls: server did not echo the legacy session ID") |
| 141 | } |
| 142 | |
| 143 | if hs.serverHello.compressionMethod != compressionNone { |
| 144 | c.sendAlert(alertIllegalParameter) |
| 145 | return errors.New("tls: server selected unsupported compression format") |
| 146 | } |
| 147 | |
| 148 | selectedSuite := mutualCipherSuiteTLS13(hs.hello.cipherSuites, hs.serverHello.cipherSuite) |
| 149 | if hs.suite != nil && selectedSuite != hs.suite { |
| 150 | c.sendAlert(alertIllegalParameter) |
| 151 | return errors.New("tls: server changed cipher suite after a HelloRetryRequest") |
| 152 | } |
| 153 | if selectedSuite == nil { |
| 154 | c.sendAlert(alertIllegalParameter) |
| 155 | return errors.New("tls: server chose an unconfigured cipher suite") |
| 156 | } |
| 157 | hs.suite = selectedSuite |
| 158 | c.cipherSuite = hs.suite.id |
| 159 | |
| 160 | return nil |
| 161 | } |
| 162 | |
| 163 | // sendDummyChangeCipherSpec sends a ChangeCipherSpec record for compatibility |
| 164 | // with middleboxes that didn't implement TLS correctly. See RFC 8446, Appendix D.4. |
no test coverage detected